Add pg_get_policy_ddl() function to reconstruct CREATE POLICY stateme… - #5
Open
akshay-joshi wants to merge 1 commit into
Open
Add pg_get_policy_ddl() function to reconstruct CREATE POLICY stateme…#5akshay-joshi wants to merge 1 commit into
akshay-joshi wants to merge 1 commit into
Conversation
akshay-joshi
force-pushed
the
new_get_policy_ddl
branch
2 times, most recently
from
May 29, 2026 06:12
e3c1007 to
f62ea39
Compare
akshay-joshi
force-pushed
the
new_get_policy_ddl
branch
2 times, most recently
from
June 29, 2026 07:52
8d53305 to
2bc8410
Compare
akshay-joshi
force-pushed
the
new_get_policy_ddl
branch
6 times, most recently
from
July 6, 2026 10:52
59b3799 to
30aa1e5
Compare
akshay-joshi
force-pushed
the
new_get_policy_ddl
branch
3 times, most recently
from
July 13, 2026 08:44
4d82fcf to
38054fe
Compare
akshay-joshi
force-pushed
the
new_get_policy_ddl
branch
from
July 16, 2026 06:20
38054fe to
c4cfaf8
Compare
akshay-joshi
force-pushed
the
new_get_policy_ddl
branch
from
July 27, 2026 07:35
c4cfaf8 to
3ce276a
Compare
pg_get_policy_ddl(table regclass,
policyname name,
pretty bool DEFAULT false)
RETURNS SETOF text
reconstructs the CREATE POLICY statement for the named row-level
security policy on the specified table. Although a single statement is
produced, the function returns a SETOF text result so its calling
convention matches the rest of the pg_get_*_ddl family.
The reconstructed DDL includes all clauses of the CREATE POLICY syntax:
the policy's permissiveness (AS RESTRICTIVE), command type (FOR
SELECT/INSERT/UPDATE/DELETE), role list (TO <roles>), USING
qualification, and WITH CHECK expression. Clauses whose value equals
the parser's default -- PERMISSIVE, FOR ALL, and TO PUBLIC -- are
omitted from the output, matching the convention used by pg_get_indexdef,
pg_get_constraintdef, pg_get_viewdef, and similar functions. The result
is therefore semantically equivalent to the original DDL, not lexically
identical.
The pretty parameter controls output formatting and defaults to false,
following the same convention as pg_get_role_ddl, pg_get_tablespace_ddl,
and pg_get_database_ddl. NULL passed explicitly for pretty is treated
as false.
NULL inputs for the table or policy name yield no rows. An invalid
relation name surfaces the regclass resolution error; a non-existent
policy raises an explicit "policy ... does not exist" error.
Usage examples:
-- compact form (default)
SELECT * FROM pg_get_policy_ddl('rls_table', 'pol1');
SELECT * FROM pg_get_policy_ddl(16564, 'pol1');
-- pretty-printed form
SELECT * FROM pg_get_policy_ddl('rls_table', 'pol1', true);
Regression coverage is added to src/test/regress/sql/rowsecurity.sql
and exercises all valid combinations of the CREATE POLICY syntax:
PERMISSIVE/RESTRICTIVE, all FOR command variants (ALL/SELECT/INSERT/
UPDATE/DELETE), multi-role TO lists, USING-only, WITH CHECK-only, and
USING+WITH CHECK policies for both ALL and UPDATE commands (the only
two that accept both), RESTRICTIVE on a specific command type,
subquery expressions, pretty and non-pretty output, all boolean
representations for the pretty argument (true/false, on/off, 1/0),
NULL and error paths, and a round-trip test that drops and re-executes
the generated DDL.
Author: Akshay Joshi <akshay.joshi@enterprisedb.com>
Reviewed-by: Rui Zhao <zhaorui126@gmail.com>
akshay-joshi
force-pushed
the
new_get_policy_ddl
branch
from
August 5, 2026 06:52
3ce276a to
f40db24
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
…nts.
This patch introduces a new system function:
pg_get_policy_ddl(table regclass, policy_name name,
VARIADIC options text[]) RETURNS setof text
which reconstructs the CREATE POLICY statement for the named row-level security policy on the specified table. The result is returned as a single row.
The supported option is:
Usage examples:
-- non-pretty formatted DDL (default)
SELECT * FROM pg_get_policy_ddl('rls_table', 'pol1');
SELECT * FROM pg_get_policy_ddl(16564, 'pol1');
Reference: PG-163
Author: Akshay Joshi akshay.joshi@enterprisedb.com